CVE-2020-37280 Details

A resource exhaustion vulnerability has been identified in the cbor-sync library, specifically in versions through 1.0.4. This vulnerability arises from the CBOR.decode function, which improperly trusts declared lengths of arrays and maps without verifying the remaining input. As a result, remote attackers can craft small CBOR payloads that declare large lengths, causing the decoder to execute billions of iterations. This behavior exhausts both CPU resources and process memory, leading to a denial-of-service condition. The issue is particularly severe under constrained memory environments, such as containers or serverless platforms, where the Node.js process can abruptly terminate due to out-of-memory errors.

Users are advised to migrate to a maintained CBOR library that validates declared sizes against available data. For those interested in applying the suggested fix, it involves modifying the decoder to check the remaining input before allocating memory based on declared lengths.